Review everything shipped this weekend, and fix what the reviewers caught

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

config/dot/quickshell/services/SoundFeedback.qml

@@ -43,19 +43,37 @@ Singleton {
     // free of file probing on a hot path.
     readonly property string homeDir: Quickshell.env("HOME") || ""
 
-    readonly property var bellCandidates: [
-        root.homeDir !== ""
-            ? `${root.homeDir}/.local/share/sounds/${root.soundTheme}/stereo/bell.oga` : "",
-        `/usr/share/sounds/${root.soundTheme}/stereo/bell.oga`,
-        "/usr/share/sounds/freedesktop/stereo/bell.oga"
-    ].filter((path, index, all) => path !== "" && all.indexOf(path) === index)
+    // The candidate paths for one XDG sound name, in preference order. Shared
+    // with Notifs.qml, which resolves a notification's own `sound-name` hint
+    // through exactly this chain rather than a second copy of it.
+    function soundCandidates(name: string): var {
+        const sound = String(name ?? "").trim();
+        // A sound name is one entry in a theme directory, never a path. Anything
+        // that could climb out of it is not a sound name, and these strings
+        // arrive from other applications.
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(sound))
+            return [];
+        return [
+            root.homeDir !== ""
+                ? `${root.homeDir}/.local/share/sounds/${root.soundTheme}/stereo/${sound}.oga` : "",
+            `/usr/share/sounds/${root.soundTheme}/stereo/${sound}.oga`,
+            `/usr/share/sounds/freedesktop/stereo/${sound}.oga`
+        ].filter((path, index, all) => path !== "" && all.indexOf(path) === index);
+    }
 
-    // The argv that plays the current theme's bell once, or nothing at all if
-    // no candidate exists. Shared with Notifs.qml, which plays the same bell
-    // for Panama's own notification popups.
-    readonly property var bellCommand: ["sh", "-c",
-        'for candidate in "$@"; do [ -f "$candidate" ] && exec pw-play "$candidate"; done; exit 0',
-        "qs-sound-feedback"].concat(root.bellCandidates)
+    readonly property var bellCandidates: root.soundCandidates("bell")
+
+    // The argv that plays the first candidate that exists, or nothing at all if
+    // none does.
+    function playCommand(candidates: var): var {
+        return ["sh", "-c",
+            'for candidate in "$@"; do [ -f "$candidate" ] && exec pw-play "$candidate"; done; exit 0',
+            "qs-sound-feedback"].concat(Array.isArray(candidates) ? candidates : []);
+    }
+
+    // The current theme's bell. Shared with Notifs.qml, which plays it for
+    // Panama's own notification popups.
+    readonly property var bellCommand: root.playCommand(root.bellCandidates)
 
     function previewAlert(): void {
         if (preview.running)